Disable Security Events Logging by Adding MiniNt Registry Key

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects the creation or modification of the 'MiniNt' registry key under 'HKLM\SYSTEM\CurrentControlSet\Control\'. The presence of this key, particularly after a system reboot, can prevent the Windows Event Log service from writing events, effectively disabling security event logging. This is a known technique used by adversaries for defense evasion.